Cisco IE 4000, Software Configuration Manual

Page: 569 / 1066

565
Configuring Network Security with ACLs
Configuration Examples for Network Security with ACLs
Routed ACLs: Examples
Figure 75 on page 565 shows a small networked office environment with routed Port 2 connected to Server A, containing
benefits and other information that all employees can access, and routed Port 1 connected to Server B, containing
confidential payroll data. All users can access Server A, but Server B has restricted access.
Use router ACLs to do this in one of two ways:

Create a standard ACL, and filter traffic coming to the server from Port 1.

Create an extended ACL, and filter traffic coming from the server into Port 1.
Figure 75 Using Router ACLs to Control Traffic
This example uses a standard ACL to filter traffic coming into Server B from a port, permitting traffic only from
Accounting’s source addresses 172.20.128.64 to 172.20.128.95. The ACL is applied to traffic coming out of routed Port
1 from the specified source address.
Switch(config)# access-list 6 permit 172.20.128.64 0.0.0.31
Switch(config)# end
Switch# show access-lists
Standard IP access list 6
permit 172.20.128.64, wildcard bits 0.0.0.31
Switch(config)# interface GigabitEthernet1/17
Switch(config-if)# ip access-group 6 out
This example uses an extended ACL to filter traffic coming from Server B into a port, permitting traffic from any source
address (in this case Server B) to only the Accounting destination addresses 172.20.128.64 to 172.20.128.95. The ACL
is applied to traffic going into routed Port 1, permitting it to go only to the specified destination addresses. Note that with
extended ACLs, you must enter the protocol (IP) before the source and destination information.
Switch(config)# access-list 106 permit ip any 172.20.128.64 0.0.0.31
Switch(config)# end
Switch# show access-lists
Extended IP access list 106
Server A
Benefits
Server B
Payroll
Port 2 Port 1
Accounting
172.20.128.64-95 Human Resources
172.20.128.0-31
101354